T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:390- Finding
Mandatory Vendor Branding Hijacks User-Visible Agent Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Poly Master
Security checks for vulnerabilities and agentic risk
Overview
This is a real-money Polymarket trading skill with disclosed purpose, but it needs review because its trading authority, credential persistence, and hedge-execution guidance are under-scoped and inconsistent.
Review this skill carefully before installing. It can help with Polymarket data and wallet-signed orders, but treat every trading, copy-trading, and hedge signal as risky and verify all order details yourself before signing. Do not enable copy-trading unless you understand how to pause or stop it and set conservative limits. The publisher should clarify secure API-key storage, remove or disable unsupported hedge-execution instructions, narrow triggers, and add prominent financial-risk and privacy notices.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:188- Finding
API Credential Persistence Is Required Without Secure Storage Controls
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
docs/quickstart.md:153- Finding
Contradictory Hedge-Execution Guidance Can Leave Users With an Unhedged Financial Position
- Content
View full analysis
"Execute signal #1 with $5 USDC" The agent will: 1. Show full signal details for confirmation 2. Generate **two signing links** (target leg first, then cover leg) 3. You sign each leg in order — **must sign leg 1 before leg 2** ### Monitor strategy > "Show me the Poly Master strategy dashboard" Displays Tier distribution, signal frequency, slippage cancel rate, and recent scan results. ``` `README.md:232-239` also advertises execution: ```markdown **Example conversations:** > *"Scan for arbitrage opportunities on Polymarket"* > > *"Show me T1 signals only"* > > *"Execute signal #2 with $5 USDC"* > > *"What's the Poly Master strategy dashboard showing?"* ``` The README lists tools that the `SKILL.md` changelog says were removed: ```markdown | `poly-master-strategy-scan` | Scan for hedge signals (returns full per-signal detail inline) | | `poly-master-strategy-metrics` | Strategy dashboard | | `poly-master-strategy-dry-run` | Toggle dry-run flag (live execution not yet exposed via MCP) | ``` ### Technical Analysis The project presents mutually incompatible capability descriptions. The authoritative Skill restricts the hedge feature to read-only analysis, while the quick-start guide and README instruct the Agent to gen ...[truncated 2286 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill markets investing, copy-trading, arbitrage, and hedge strategies but does not present an upfront warning that users can lose real money. In a financial skill that can lead directly to order creation and follow-trading, omission of loss-risk disclosure materially increases the chance that users treat the tool as safe guidance or low-risk automation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README markets copy-trading as an automated feature that checks for new trades every 30 seconds and can 'start monitoring and mirroring trades,' but the nearby examples do not clearly warn that this may trigger ongoing autonomous trading activity after initial setup. In a financial trading skill, that omission is dangerous because users may authorize behavior with continuing market and loss exposure without understanding how to pause, stop, or constrain it immediately.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list includes very broad terms such as 'poly', 'prediction market', 'smart money', 'arbitrage', and generic Chinese equivalents, which can cause the skill to activate in unrelated conversations. Overbroad auto-invocation is risky here because the skill can steer users into real-money trading flows, wallet collection, and financial recommendations without sufficiently clear user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill promotes wallet profiling, trader ranking, top-holder analysis, and enrichment of wallet performance metrics without an upfront explanation of what data is collected, how it is sourced, and what privacy limitations apply. In this context, users may be encouraged to submit wallet addresses or analyze third-party wallets without understanding surveillance, attribution, or data-retention implications.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly states that hedge execution is not currently available via MCP, but later defines a concrete two-leg execution output format that can normalize or encourage automated execution behavior. In a trading context, this inconsistency can mislead an agent into presenting executable hedge steps the backend does not safely support, increasing the chance of partial fills, user confusion, or unauthorized implied trading capability.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This quickstart actively guides users through real-money trading, copy-trading, and hedge/arbitrage execution, but does not prominently warn about financial loss, model error, liquidity/slippage, or the risks of mirroring other traders. In this skill context, the omission is more dangerous because the document presents AI-driven signals and copy-trading workflows in an action-oriented way that could encourage inexperienced users to treat suggestions as low-risk or near-automatic.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The README encourages wallet profiling, leaderboard analysis, and top-holder lookup of third-party addresses without a nearby privacy or data-use disclosure. While blockchain activity is often public, presenting profiling features through an AI skill lowers friction for surveillance-style analysis and can enable targeting, doxxing, or behavioral tracking of identifiable traders if users are not warned about appropriate use and data sensitivity.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file is written almost entirely in English but ends with a Chinese sentence, which introduces a language choice implicitly without user opt-in or explanation. This can violate a language/locale policy requiring consistent language or explicit user selection.
- Content